Thanks Fokko. I missed the second Jackson upgrade. Here’s another CVE fix to backport https://github.com/apache/parquet-java/pull/3908. PTAL.
Russell Spitzer <[email protected]>于2026年10月29日 周四03:47写道： > I think the Jackson patch would let us remove a dependency Trivy exception > in Iceberg so that would be good to have. Also I think this would be a > great time to test out the new release automation :) > > On Wed, Oct 28, 2026 at 11:13 AM Fokko Driesprong <[email protected]> > wrote: > > > Hi all, > > > > Heads up: while reviewing the 1.18.x branch, I noticed the Jackson > > patches (2.22.3 -> 2.22.4) that landed on master weren't included yet, so > > I've prepared a PR against the parquet-1.18.x branch that > > cherry-picks both: > > > > https://github.com/apache/parquet-java/pull/3893 > > > > It would be great to include this one in 1.18.2 alongside the Thrift and > > Snappy backports Manu prepared. > > > > Kind regards, > > Fokko > > > > Sent from Proton Mail > > >
